Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7a005e7fb2065c0…

MALICIOUS

PDF

80.1 KB Created: 2021-04-28 05:03:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13
MD5: dff28bf1f41812fb8628ee99b84eaaac SHA-1: ccdba0d52576449959f739800221f0bd0e2a4622 SHA-256: a7a005e7fb2065c05008a8a64efa6ce7b7d29b8eabd68f25a46d21f465f11458
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. The document contains numerous links, many pointing to compromised WordPress sites, suggesting a link farm designed to redirect users. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing or redirection campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8849

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://recamonde.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16086b0a9878d0---29716381285.pdf In PDF document text
    • http://bestforfishing.com/wp-content/plugins/super-forms/uploads/php/files/02ddfccf64bff58b4c0d3dc8ee89b96a/16075304943.pdfIn PDF document text
    • https://pilotcenter.gr/wp-content/plugins/super-forms/uploads/php/files/blokl9uicr9daq0u6jnb7f0apj/sodojasazigawaxakewuz.pdfIn PDF document text
    • http://jamoncup.es/wp-content/plugins/formcraft/file-upload/server/content/files/160829ba8794bb---15909673588.pdfIn PDF document text
    • http://math-talk.kr/wp-content/plugins/super-forms/uploads/php/files/4tpnucsdk71pvgqg15b7u9mr40/50649415782.pdfIn PDF document text
    • http://www.putnamtaxi.net/wp-content/plugins/formcraft/file-upload/server/content/files/16087c710d48d8---49993514212.pdfIn PDF document text
    • https://www.blackandwhite-salon.com/wp-content/plugins/super-forms/uploads/php/files/8433ba5569030b06b3f8c00b73812191/rezuzonodoviwapiwukuwuxim.pdfIn PDF document text
    • https://glasschneider.koeln/wp-content/plugins/super-forms/uploads/php/files/9b22434ppd1cppo5m4rf27rr93/zituwatorizok.pdfIn PDF document text
    • https://aduanaldelvalle.com/userfiles/file/xagiba.pdfIn PDF document text
    • https://ccveg.org/wp-content/plugins/super-forms/uploads/php/files/9hl3je3chc24u6bf1012p813a9/sakutorudufoxitulirusoxi.pdfIn PDF document text
    • https://aliencosmicexpo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cd8a6af8ca---75491751385.pdfIn PDF document text
    • https://www.keystonecare.co.uk/wp-content/plugins/super-forms/uploads/php/files/3da1afb1e79e218544b8b3247fdacc72/48991176980.pdfIn PDF document text
    • https://gfow.om/wp-content/plugins/super-forms/uploads/php/files/budi1t7nta6lkk9iloqjb2nf2b/poxamegurewijotudevolale.pdfIn PDF document text
    • http://www.altrus.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1607752b0a4c80---90218689145.pdfIn PDF document text
    • http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f24607b346---tugufaruxizisexasetel.pdfIn PDF document text
    • https://www.focus.mu/wp-content/plugins/super-forms/uploads/php/files/28cc8d9cdc6903d9e24975831454d652/fapuvikolideteg.pdfIn PDF document text
    • https://wavesmaroochydore.com/wp-content/plugins/super-forms/uploads/php/files/uved9htbtd0ttmv002ih7nuao8/bodozokudonigiz.pdfIn PDF document text
    • https://rclurie.com/wp-content/plugins/super-forms/uploads/php/files/fcc21165f58b419e6fffac97b9b4e088/41897773905.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/A3Ryygt5BCM/uplcv?utm_term=reporter+evelyn+bastos+instagramPDF link annotation
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD0E5 3008 bytes
SHA-256: 7db55122cd6726e4cd87e7405f145dfd0a0adb6150b538bc041eecccdc0224e1
font_01_sfnt_off0000db80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB80 5448 bytes
SHA-256: 57468f9d6982f3567dd84b93e3bfbe8e1960f20dc9781fb656e4c5256b651c9b
font_02_sfnt_off0000edfc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDFC 4664 bytes
SHA-256: ea284ba3352f49925a10b814e87c4324ebf19b4e08f7e36527e04d9aa33b7ede
font_03_sfnt_off0000fafb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFAFB 13148 bytes
SHA-256: 4aa9d2c6bb77662ac1990448da5f015cdca60e1a43c9885ade308c34233a5676
font_04_sfnt_off000123dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x123DC 16908 bytes
SHA-256: 2cd4a16cc6879677174f43c8724156a57092929aebfb0f376114e0cb1c63392f

Open this report in the interactive analyzer, or submit your own file for analysis.